Reference
Security dictionary
Short definitions for WordPress security terms. Use these when a guide gets into jargon, or skim by category when you are learning the landscape.
Browse by category
Attacks
Common ways WordPress sites get hit.
- 404 scanning 404 scanning is automated probing of missing URLs to find leftovers, backups, and known vulnerable paths.
- Account takeover Account takeover is when an attacker gains control of a legitimate user account and can act as that user.
- Backdoor A backdoor is hidden access an attacker leaves so they can return without the original vulnerability.
- Brute force A brute-force attack tries many passwords or tokens until one works, usually against the login form.
- Credential stuffing Credential stuffing replays usernames and passwords stolen from other breaches against your login.
- Cross-site scripting (XSS) Cross-site scripting (XSS) injects malicious JavaScript into pages that other users’ browsers will run.
- CSRF CSRF tricks a logged-in browser into sending a request the user did not mean to send.
- DDoS A DDoS attack floods a site or its infrastructure with traffic so legitimate visitors cannot get through.
- File upload vulnerability A file upload vulnerability lets an attacker place a dangerous file on the server, often leading to a webshell.
- Malware Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.
- Phishing Phishing tricks people into handing over credentials or installing malware by impersonating a trusted party.
- Remote code execution Remote code execution is a vulnerability that lets an attacker run attacker-controlled code on the server.
- SQL injection SQL injection tricks a database query into running attacker-controlled SQL, often through unsafe input handling.
- Webshell A webshell is a small script uploaded to the server that lets an attacker run commands through the browser.
Access
Logins, roles, and who can do what.
- Application passwords Application passwords are per-app credentials WordPress can issue so integrations authenticate without using your main password.
- Least privilege Least privilege means each user and integration gets only the access required for their job, nothing more.
- Privilege escalation Privilege escalation is gaining higher access than intended, such as a subscriber becoming an administrator.
- Session hijacking Session hijacking steals or guesses a valid session so the attacker acts as the logged-in user.
- Two-factor authentication (2FA) Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- WordPress user roles User roles group capabilities that decide what each account can do in WordPress, from reading to full admin.
Hardening
Controls that raise the cost of an attack.
- Core file integrity Core file integrity is the assurance that WordPress core files match known-good versions and have not been tampered with.
- File integrity monitoring File integrity monitoring checks whether important files changed compared with a known-good baseline.
- Rate limiting Rate limiting caps how often an action can happen from an IP or account, which slows automated abuse.
- Security hardening Hardening is the set of configuration and process changes that make a site harder to abuse.
- Security headers Security headers are HTTP response headers that tell browsers how to treat your pages for safer defaults.
- SSL/TLS SSL/TLS encrypts traffic between browsers and your server so passwords and cookies are harder to sniff.
- WordPress WAF A WAF filters HTTP traffic to block common web attacks before they reach WordPress.
Monitoring
Finding issues before they become incidents.
- CVE A CVE is a public identifier for a known cybersecurity vulnerability tracked in shared databases.
- Event logging Event logging records security-relevant actions so you can see what changed and when.
- False negative A false negative is a real security problem that a tool or process failed to detect.
- False positive A false positive is an alert that looks like a problem but turns out to be benign after review.
- Scheduled scanning Scheduled scanning runs security checks automatically on a repeating timetable and can alert you to new findings.
- Security audit A security audit is a structured review of a site’s risks, misconfigurations, and recommended fixes.
- Vulnerability A vulnerability is a weakness in software that attackers can abuse to break confidentiality, integrity, or availability.
Mentality
How to think about risk without the theater.
- Assume breach Assume breach means designing as if an attacker may already have a foothold, so detection and recovery matter as much as prevention.
- Defense in depth Defense in depth stacks multiple controls so one missed update or weak password is less likely to end in disaster.
- Incident response Incident response is the structured process of detecting, containing, cleaning, and learning from a security incident.
- Security theater Security theater is activity that feels protective but does not meaningfully reduce real risk.
- Zero trust Zero trust treats every request as untrusted until verified, and limits what any one identity can reach.
WordPress-specific
Terms that only make sense on WordPress.
- Login protection Login protection is the set of controls that harden the WordPress login against bots and credential attacks.
- Nulled plugin A nulled plugin is an unauthorized, usually modified copy of a paid plugin that often includes malware or backdoors.
- Plugin supply chain Plugin supply-chain risk is when trusted plugin code or updates become a path for attackers.
- REST API The WordPress REST API is an HTTP JSON interface at /wp-json/ used by the editor, apps, and many plugins.
- WordPress nonce A WordPress nonce is a short-lived token used to verify that a request was intentional, mainly to reduce CSRF risk.
- WordPress salts WordPress salts are secret keys in wp-config.php that help secure cookies, nonces, and related cryptographic operations.
- wp-config.php wp-config.php holds database credentials, keys, and core WordPress settings for the site.
- XML-RPC XML-RPC is an older WordPress API endpoint attackers often abuse for brute force and amplification.